I'll describe a physical case of what I'm asking about -- we might call it the 'Just sign on the dotted line' attack. I'm asking if it's technically possible since one is required to open the hardware to input signals from the MEW website.
Blockchain technology works by signing transactions with our private key. This key is what our Ledger backup seed restores to the device. Once we sign the transaction, it's sent to and confirmed by the network.
Suppose someone is handed a check to sign with someone's name on it. The see the correct name on the check so they sign it. However, that correct name was actually a sticker and the criminal peels it off, revealing a different name on the check that now has the necessary signature on it. In this way one is tricked into signing a transaction with undesired information that appeared correct.
I am asking if the same thing can be done via the signals sent from the MEW site to the Ledger, i.e. such that the address displayed by the Ledger is in fact not the address involved in the transaction being signed.
If it is not possible, why not? If possible, can you cite the pertinent code demonstrating the impossibility?